login.secure.mygovonline.msgsecure.com.au Open in urlscan Pro
172.67.165.42 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://nosokhome.online/
Effective URL:
https://login.secure.mygovonline.msgsecure.com.au/run/
Submission Tags: @ecarlesi possiblethreat phishing Search All
Submission: On October 27 via api (October 27th 2024, 11:26:48 pm UTC) from IT — Scanned from IT

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 4 countries across 6 domains to perform 10 HTTP transactions. The main IP is 172.67.165.42, located in United States and belongs to CLOUDFLARENET, US. The main domain is login.secure.mygovonline.msgsecure.com.au.
TLS certificate: Issued by WE1 on October 21st 2024. Valid for: 3 months.

This is the only time login.secure.mygovonline.msgsecure.com.au was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Australian Government (Government)

Domain & IP information

	IP Address	AS Autonomous System
1 1	84.32.84.32 84.32.84.32	47583 (AS-HOSTINGER) (AS-HOSTINGER)
1	172.67.165.42 172.67.165.42	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	95.100.135.66 95.100.135.66	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2 3	203.161.61.2 203.161.61.2	22612 (NAMECHEAP...) (NAMECHEAP-NET)
2	104.126.37.131 104.126.37.131	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	46.105.222.81 46.105.222.81	16276 (OVH) (OVH)
4	23.56.202.168 23.56.202.168	16625 (AKAMAI-AS) (AKAMAI-AS)
10	6

1 84.32.84.32 (Lithuania) 1 redirects

ASN47583 (AS-HOSTINGER, CY)

nosokhome.online	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.165.42 (United States)

ASN13335 (CLOUDFLARENET, US)

login.secure.mygovonline.msgsecure.com.au	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 95.100.135.66 (Frankfurt am Main, Germany) 1 redirects

ASN20940 (AKAMAI-ASN1, NL)
PTR: a95-100-135-66.deploy.static.akamaitechnologies.com

img1.wsimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 203.161.61.2 (United States) 2 redirects

ASN22612 (NAMECHEAP-NET, US)
PTR: server1.milnert.com

yenergyconstruction.online	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.126.37.131 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a104-126-37-131.deploy.static.akamaitechnologies.com

events.api.secureserver.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 46.105.222.81 (France)

ASN16276 (OVH, FR)
PTR: ns3236370.ip-46-105-222.eu

i.postimg.cc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 23.56.202.168 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-56-202-168.deploy.static.akamaitechnologies.com

csp.secureserver.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	secureserver.net events.api.secureserver.net — Cisco Umbrella Rank: 13177 csp.secureserver.net — Cisco Umbrella Rank: 13220	600 B
3	yenergyconstruction.online 2 redirects yenergyconstruction.online	591 B
2	wsimg.com 1 redirects img1.wsimg.com — Cisco Umbrella Rank: 10296	21 KB
1	postimg.cc i.postimg.cc — Cisco Umbrella Rank: 17317	481 B
1	msgsecure.com.au login.secure.mygovonline.msgsecure.com.au	1 KB
1	nosokhome.online 1 redirects nosokhome.online	338 B
10	6

	Domain	Requested by
4	csp.secureserver.net	img1.wsimg.com
3	yenergyconstruction.online	2 redirects login.secure.mygovonline.msgsecure.com.au
2	events.api.secureserver.net	img1.wsimg.com
2	img1.wsimg.com	1 redirects login.secure.mygovonline.msgsecure.com.au
1	i.postimg.cc
1	login.secure.mygovonline.msgsecure.com.au
1	nosokhome.online	1 redirects
10	7

This site contains no links.

Subject Issuer	Validity	Valid
login.secure.mygovonline.msgsecure.com.au WE1	`2024-10-21` - `2025-01-19`	3 months	crt.sh
yenergyconstruction.online R10	`2024-10-22` - `2025-01-20`	3 months	crt.sh
*.api.secureserver.net Starfield Secure Certificate Authority - G2	`2024-07-15` - `2025-08-16`	a year	crt.sh
postimg.cc E5	`2024-10-20` - `2025-01-18`	3 months	crt.sh
*.secureserver.net Starfield Secure Certificate Authority - G2	`2024-10-17` - `2025-11-18`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://login.secure.mygovonline.msgsecure.com.au/run/
Frame ID: C7D2EF7942566F50BE20B4AC6B337EAE
Requests: 7 HTTP requests in this frame

Frame: https://yenergyconstruction.online/run/australian-mygov-RD1589-user-otp-detail-pic-tele/log.html
Frame ID: 3F00BBE316B002F6521CF671BFFEC336
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Login with myGov - myGov

Page URL History Show full URLs

http://nosokhome.online/ HTTP 307
https://nosokhome.online/ HTTP 302
https://login.secure.mygovonline.msgsecure.com.au/run/ Page URL

Page Statistics

10
Requests

90 %
HTTPS

0 %
IPv6

6
Domains

7
Subdomains

6
IPs

4
Countries

23 kB
Transfer

107 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://nosokhome.online/ HTTP 307
https://nosokhome.online/ HTTP 302
https://login.secure.mygovonline.msgsecure.com.au/run/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://img1.wsimg.com/traffic-assets/js/tccl.min.js HTTP 301
https://img1.wsimg.com/signals/js/clients/scc-c2/scc-c2.min.js

Request Chain 1

https://yenergyconstruction.online/run/australian-mygov-RD1589-user-otp-detail-pic-tele HTTP 301
https://yenergyconstruction.online/run/australian-mygov-RD1589-user-otp-detail-pic-tele/ HTTP 302
https://yenergyconstruction.online/run/australian-mygov-RD1589-user-otp-detail-pic-tele/log.html

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
login.secure.mygovonline.msgsecure.com.au/run/
Redirect Chain

http://nosokhome.online/
https://nosokhome.online/
https://login.secure.mygovonline.msgsecure.com.au/run/

1 KB
1 KB

1239ms
581ms

Document
text/html

172.67.165.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://login.secure.mygovonline.msgsecure.com.au/run/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.165.42 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bead33b39745a397ecd61ef167ccefe916508f9e4031ce125f8e718de675a159

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8d9673d9fac80786-MRS
content-encoding: br
content-type: text/html
date: Sun, 27 Oct 2024 23:26:42 GMT
last-modified: Tue, 22 Oct 2024 19:59:25 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RTRgGWn%2FAikekbHfYosciqz2U7g%2BpV1AUY%2FQyI2in6oo5fl%2Flku7YgrEfh98jmj%2BjeQlGM970wIMekQeQ7PqRQgajF%2ByqxBnVKY5mzKDEYsomttA6WQ1cEN7LgK9wtk12HQwCk9jtaEUyH5ay2uELmX4ZtbvoRpIGz4ScQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=TCP&rtt=25791&sent=8&recv=11&lost=0&retrans=0&sent_bytes=3982&recv_bytes=2343&delivery_rate=151660&cwnd=253&unsent_bytes=0&cid=642260c43c58aa6d&ts=629&x=0"
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400
content-length: 137
content-type: text/html
date: Sun, 27 Oct 2024 23:26:41 GMT
location: https://login.secure.mygovonline.msgsecure.com.au/run/
server: hcdn
x-hcdn-cache-status: DYNAMIC
x-hcdn-request-id: 0eeb1ca76d8a0e077fcdf78b1b8d7eaf-fra-edge2

GET
H2

200

scc-c2.min.js Show response
img1.wsimg.com/signals/js/clients/scc-c2/
Redirect Chain

https://img1.wsimg.com/traffic-assets/js/tccl.min.js
https://img1.wsimg.com/signals/js/clients/scc-c2/scc-c2.min.js

105 KB
21 KB

40ms
40ms

Script
text/javascript

95.100.135.66
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://img1.wsimg.com/signals/js/clients/scc-c2/scc-c2.min.js
Requested by: Host: login.secure.mygovonline.msgsecure.com.au
URL: https://login.secure.mygovonline.msgsecure.com.au/run/
Protocol: H2
Server: 95.100.135.66 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a95-100-135-66.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 1b4dacb0dafda81d48ee0890ea113b3b8275bf2d16d5325f971f16eb75f7218a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://login.secure.mygovonline.msgsecure.com.au/

Response headers

content-encoding: gzip
x-amz-meta-version: 0.4.7
etag: "6a7950cc31489069917bf817b62b2bfe"
x-amz-version-id: 4pexUB2ckSZgPfbjokD3loiC8DEV2lsi
expires: Sun, 27 Oct 2024 23:56:43 GMT
date: Sun, 27 Oct 2024 23:26:43 GMT
last-modified: Tue, 24 Sep 2024 20:55:06 GMT
content-type: text/javascript
vary: Accept-Encoding
x-amz-id-2: 2oZBOYcHIf/9+EJUWAIFnVt8ROH/hHdM1DOWHclawfBflG1aoSr7ljY+4XYzsxkiCuDRr1i8bFw=
cache-control: max-age=1800
timing-allow-origin: *
x-amz-request-id: NPGR8HR7WK9NRVZS
accept-ranges: bytes
access-control-allow-origin: *
content-length: 20968
x-amz-server-side-encryption: AES256

Redirect headers

expires: Mon, 27 Oct 2025 23:26:43 GMT
cache-control: max-age=31536000
location: https://img1.wsimg.com/signals/js/clients/scc-c2/scc-c2.min.js
content-length: 0
access-control-allow-origin: *
date: Sun, 27 Oct 2024 23:26:43 GMT
timing-allow-origin: *

GET
H/1.1

200
OK

log.html
yenergyconstruction.online/run/australian-mygov-RD1589-user-otp-detail-pic-tele/ Frame 3F00
Redirect Chain

https://yenergyconstruction.online/run/australian-mygov-RD1589-user-otp-detail-pic-tele
https://yenergyconstruction.online/run/australian-mygov-RD1589-user-otp-detail-pic-tele/
https://yenergyconstruction.online/run/australian-mygov-RD1589-user-otp-detail-pic-tele/log.html

0
0

183ms
182ms

Document
text/html

203.161.61.2
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://yenergyconstruction.online/run/australian-mygov-RD1589-user-otp-detail-pic-tele/log.html
Requested by: Host: login.secure.mygovonline.msgsecure.com.au
URL: https://login.secure.mygovonline.msgsecure.com.au/run/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 203.161.61.2 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: server1.milnert.com
Software: Apache /
Resource Hash

Request headers

Referer: https://login.secure.mygovonline.msgsecure.com.au/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 2939
Content-Type: text/html
Date: Sun, 27 Oct 2024 23:26:46 GMT
Keep-Alive: timeout=5, max=98
Last-Modified: Tue, 22 Oct 2024 12:18:50 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent

Redirect headers

Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 22
Content-Type: text/html; charset=UTF-8
Date: Sun, 27 Oct 2024 23:26:44 GMT
Keep-Alive: timeout=5, max=99
Location: ./log.html
Server: Apache
Vary: Accept-Encoding,User-Agent

GET
H2 200 event Show response
events.api.secureserver.net/t/1/tl/ 43 B
300 B 722ms
243ms Fetch
image/gif 104.126.37.131
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: img1.wsimg.com
URL: https://img1.wsimg.com/traffic-assets/js/tccl.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.126.37.131 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a104-126-37-131.deploy.static.akamaitechnologies.com

Software

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://login.secure.mygovonline.msgsecure.com.au/

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
x-robots-tag: noindex, nofollow
cache-control: private
access-control-allow-credentials: true
x-content-type-options: nosniff
access-control-allow-origin: https://login.secure.mygovonline.msgsecure.com.au
content-length: 43
x-xss-protection: 1; mode=block
date: Sun, 27 Oct 2024 23:26:48 GMT
content-type: image/gif
x-frame-options: DENY

GET
H2 200 event Show response
events.api.secureserver.net/t/1/tl/ 43 B
300 B 673ms
199ms Fetch
image/gif 104.126.37.131
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://events.api.secureserver.net/t/1/tl/event?dh=login.secure.mygovonline.msgsecure.com.au&dr=&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F130.0.0.0%20Safari%2F537.36&client_name=scc-c2&cv=0.4.7&vg=5212ab08-2ff6-4071-871b-148ae6c32159&vtg=5212ab08-2ff6-4071-871b-148ae6c32159&dp=%2Frun&trace_id=45e0c7107dba4a9f9ff138ead6253ea3&cts=2024-10-27T23%3A26%3A47.630Z&hit_id=0d7cdc49-80bc-4022-9205-22917f45f24e&ea=pageperf&ht=perf&eid=traffic.tcc.instrumentation.navigation.timing&trfd=%7B%22ap%22%3A%22cpsh-oh%22%2C%22server%22%3A%22sg2plzcpnl505543%22%2C%22dcenter%22%3A%22sg2%22%2C%22cp_id%22%3A%2210099840%22%2C%22cp_cl%22%3A%228%22%7D&ap=cpsh-oh&vci=1246923645&z=922703337&tce=1730071602190&tcs=1730071601555&tdc=1730071607624&tdclee=1730071603388&tdcles=1730071603388&tdi=1730071603388&tdl=1730071602914&tdle=1730071601549&tdls=1730071601535&tfs=1730071601529&tns=1730071600661&trqs=1730071602191&tre=1730071602774&trps=1730071602772&tles=1730071607624&tlee=0&nt=navigate&nav_type=hard

Requested by

Host: img1.wsimg.com
URL: https://img1.wsimg.com/traffic-assets/js/tccl.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.126.37.131 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a104-126-37-131.deploy.static.akamaitechnologies.com

Software

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://login.secure.mygovonline.msgsecure.com.au/

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
x-robots-tag: noindex, nofollow
cache-control: private
access-control-allow-credentials: true
x-content-type-options: nosniff
access-control-allow-origin: https://login.secure.mygovonline.msgsecure.com.au
content-length: 43
x-xss-protection: 1; mode=block
date: Sun, 27 Oct 2024 23:26:48 GMT
content-type: image/gif
x-frame-options: DENY

GET
H2 200 favico.png
i.postimg.cc/Z5cKQ3TW/ 238 B
481 B 388ms
131ms Other
image/png 46.105.222.81
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://i.postimg.cc/Z5cKQ3TW/favico.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 46.105.222.81 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3236370.ip-46-105-222.eu
Software: nginx /
Resource Hash: 5e70f30259d620e25efa88586a8871d5c94113f0b0d7d6f3e817f585891bf154

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://login.secure.mygovonline.msgsecure.com.au/

Response headers

cache-control: max-age=315360000, public
access-control-allow-methods: GET, OPTIONS
expires: Thu, 31 Dec 2037 23:55:55 GMT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 238
date: Sun, 27 Oct 2024 23:26:48 GMT
content-type: image/png
last-modified: Tue, 27 Aug 2024 19:55:24 GMT
server: nginx

POST
H/1.1 202
Accepted eventbus
csp.secureserver.net/ 0
0 254ms
252ms Fetch
application/json 23.56.202.168
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://csp.secureserver.net/eventbus

Requested by

Host: img1.wsimg.com
URL: https://img1.wsimg.com/traffic-assets/js/tccl.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.56.202.168 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-202-168.deploy.static.akamaitechnologies.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains ; preload

Request headers

Authorization: api-key b18ef4f046435b64a469b32c3c1c20a3
Referer: https://login.secure.mygovonline.msgsecure.com.au/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

Strict-Transport-Security: max-age=86400 ; includeSubDomains ; preload
Cache-Control: max-age=0, no-cache, no-store
x-amz-apigw-id: AVTY6EoJoAMEfMQ=
x-envoy-upstream-service-time: 101
Pragma: no-cache
x-amzn-trace-id: Root=1-671ecc38-7cf2978b793034ba64b5fdf7
Connection: keep-alive
x-amzn-requestid: 7c38f14b-1d08-456c-bca7-ab97235917e6
Expires: Sun, 27 Oct 2024 23:26:48 GMT
Access-Control-Allow-Origin: *
Content-Length: 0
Date: Sun, 27 Oct 2024 23:26:48 GMT
Content-Type: application/json

POST
H/1.1 202
Accepted eventbus
csp.secureserver.net/ 0
0 266ms
264ms Fetch
application/json 23.56.202.168
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://csp.secureserver.net/eventbus

Requested by

Host: img1.wsimg.com
URL: https://img1.wsimg.com/traffic-assets/js/tccl.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.56.202.168 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-202-168.deploy.static.akamaitechnologies.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains ; preload

Request headers

Authorization: api-key 8da2217409854bee82e12dc4ca0b39fb
Referer: https://login.secure.mygovonline.msgsecure.com.au/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

Strict-Transport-Security: max-age=86400 ; includeSubDomains ; preload
Cache-Control: max-age=0, no-cache, no-store
x-amz-apigw-id: AVTY6EryIAMEQPg=
x-envoy-upstream-service-time: 86
Pragma: no-cache
x-amzn-trace-id: Root=1-671ecc38-310942514eea6fed78defdbb
Connection: keep-alive
x-amzn-requestid: 934d765b-7740-4329-b66d-2d690314050f
Expires: Sun, 27 Oct 2024 23:26:48 GMT
Access-Control-Allow-Origin: *
Content-Length: 0
Date: Sun, 27 Oct 2024 23:26:48 GMT
Content-Type: application/json

OPTIONS
H/1.1 200
OK eventbus
csp.secureserver.net/ Frame 0
0 673ms
192ms Preflight
application/json 23.56.202.168
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://csp.secureserver.net/eventbus

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.56.202.168 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-202-168.deploy.static.akamaitechnologies.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains ; preload

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: https://login.secure.mygovonline.msgsecure.com.au
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Headers: content-type,authorization
Access-Control-Allow-Methods: OPTIONS,POST
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 0
Content-Type: application/json
Date: Sun, 27 Oct 2024 23:26:48 GMT
Expires: Sun, 27 Oct 2024 23:26:48 GMT
Pragma: no-cache
Strict-Transport-Security: max-age=86400 ; includeSubDomains ; preload
x-amz-apigw-id: AVTY4EnXoAMEDZQ=
x-amzn-requestid: c271693a-9978-443c-bf6f-abaf0a2c77a4
x-amzn-trace-id: Root=1-671ecc38-53fae52c7b732b9c30e54a98
x-envoy-upstream-service-time: 9

OPTIONS
H/1.1 200
OK eventbus
csp.secureserver.net/ Frame 0
0 636ms
175ms Preflight
application/json 23.56.202.168
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://csp.secureserver.net/eventbus

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.56.202.168 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-202-168.deploy.static.akamaitechnologies.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains ; preload

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: https://login.secure.mygovonline.msgsecure.com.au
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Headers: content-type,authorization
Access-Control-Allow-Methods: OPTIONS,POST
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 0
Content-Type: application/json
Date: Sun, 27 Oct 2024 23:26:48 GMT
Expires: Sun, 27 Oct 2024 23:26:48 GMT
Pragma: no-cache
Strict-Transport-Security: max-age=86400 ; includeSubDomains ; preload
x-amz-apigw-id: AVTY4G9qIAMEjRg=
x-amzn-requestid: d028f633-1d35-4688-a5e3-3ceb563af4b5
x-amzn-trace-id: Root=1-671ecc38-4edbbf173d431fc945de68d7
x-envoy-upstream-service-time: 5

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Australian Government (Government)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.msgsecure.com.au/	1970-01-21 09:20:07	Name: _tccl_visitor Value: 5212ab08-2ff6-4071-871b-148ae6c32159
.msgsecure.com.au/	1970-01-21 00:34:33	Name: _tccl_visit Value: 5212ab08-2ff6-4071-871b-148ae6c32159
.msgsecure.com.au/	1970-01-21 00:34:32	Name: _scc_session Value: pc=1&C_TOUCH=2024-10-27T23:26:43.385Z

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

csp.secureserver.net
events.api.secureserver.net
i.postimg.cc
img1.wsimg.com
login.secure.mygovonline.msgsecure.com.au
nosokhome.online
yenergyconstruction.online
104.126.37.131
172.67.165.42
203.161.61.2
23.56.202.168
46.105.222.81
84.32.84.32
95.100.135.66
1b4dacb0dafda81d48ee0890ea113b3b8275bf2d16d5325f971f16eb75f7218a
5e70f30259d620e25efa88586a8871d5c94113f0b0d7d6f3e817f585891bf154
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
bead33b39745a397ecd61ef167ccefe916508f9e4031ce125f8e718de675a159

login.secure.mygovonline.msgsecure.com.au Open in urlscan Pro 172.67.165.42 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

10 Requests

90 %HTTPS

0 %IPv6

6 Domains

7 Subdomains

6 IPs

4 Countries

23 kBTransfer

107 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

3 Cookies

Indicators

login.secure.mygovonline.msgsecure.com.au Open in urlscan Pro
172.67.165.42 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

90 %
HTTPS

0 %
IPv6

6
Domains

7
Subdomains

6
IPs

4
Countries

23 kB
Transfer

107 kB
Size

3
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!